{"id":500,"date":"2016-09-28T19:44:43","date_gmt":"2016-09-28T19:44:43","guid":{"rendered":"http:\/\/blog.mozilla.org\/webqa\/?p=500"},"modified":"2016-09-28T19:44:43","modified_gmt":"2016-09-28T19:44:43","slug":"further-enhancements-and-capabilities-added-to-my-dockerzap-cli-scriptjenkins-integration","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/fxtesteng\/2016\/09\/28\/further-enhancements-and-capabilities-added-to-my-dockerzap-cli-scriptjenkins-integration\/","title":{"rendered":"Further enhancements and capabilities added to my Docker+ZAP-CLI script\/Jenkins integration"},"content":{"rendered":"

Since my third follow-up post<\/a> on my Docker + OWASP ZAP-CLI<\/a> + Jenkins work — most of which lies in my docker-zap GitHub repo<\/a>, I’ve made both small and key improvements, which I’d like to highlight, here:<\/p>\n

    \n
  1. fixed the hardcoded sleep 20<\/code> call, and instead use the provided status<\/code> flag\/state, so we only start running the ZAP-CLI when the daemon\/API is ready (https:\/\/github.com\/stephendonner\/docker-zap\/issues\/1<\/a>)<\/li>\n
  2. instead of a statically-specified host in the shell script, we pass in a variable (with a default TARGET_URL<\/code> in the accompanying Jenkins job config, that is easily overridden by entering a new value in the build-job prompt (https:\/\/github.com\/stephendonner\/docker-zap\/issues\/4<\/a>)<\/li>\n
  3. I now use the provided alerts<\/code> command to output a nice, easy-to-read table if there are found issues — complete with the following (https:\/\/github.com\/stephendonner\/docker-zap\/issues\/10<\/a>):\n
      \n
    1. type of alert\/issue<\/li>\n
    2. risk<\/li>\n
    3. CWE ID<\/a> (Common Weakness Enumeration)<\/li>\n
    4. URL<\/li>\n<\/ol>\n<\/li>\n
    5. because the aim in this particular instance’s use is to try to find Web-application vulnerabilities throughout development cycles (including post-release), I now invoke ATTACK mode<\/code> upon start-up of ZAP itself (https:\/\/github.com\/stephendonner\/docker-zap\/issues\/12<\/a>)<\/li>\n
    6. a minor addition, for clarity, is that I’ve added a separator between the ZAP-CLI’s output and the full, raw engine’s log (https:\/\/github.com\/stephendonner\/docker-zap\/issues\/13<\/a>)<\/li>\n<\/ol>\n

      Here’s sample output: http:\/\/pastebin.com\/bLmKkMws<\/a><\/p>\n

      And a high-level overview in my Docker-ZAP-CLI screencast<\/a>.<\/p>\n

      I’m still anticipating wider adoption and integration of ZAP, whether that’s through my particular setup, or something else, so please feel free to contribute pull requests and ask\/answer questions, etc., preferably through GitHub Issues<\/a>.<\/p>\n

      Thanks!<\/p>\n

      Stephen<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

      Since my third follow-up post on my Docker + OWASP ZAP-CLI + Jenkins work — most of which lies in my docker-zap GitHub repo, I’ve made both small and key … Read more<\/a><\/p>\n","protected":false},"author":512,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[228,278094,542,31342,4553,69,265,278096],"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/fxtesteng\/wp-json\/wp\/v2\/posts\/500"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/fxtesteng\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/fxtesteng\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/fxtesteng\/wp-json\/wp\/v2\/users\/512"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/fxtesteng\/wp-json\/wp\/v2\/comments?post=500"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/fxtesteng\/wp-json\/wp\/v2\/posts\/500\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/fxtesteng\/wp-json\/wp\/v2\/media?parent=500"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/fxtesteng\/wp-json\/wp\/v2\/categories?post=500"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/fxtesteng\/wp-json\/wp\/v2\/tags?post=500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}